Login security and 2FA

A second factor keeps an account safe when its password leaks. Hive brings authenticator apps, e-mail codes, passkeys and hardware keys in the free plugin, with recovery codes, trusted devices and enforcement per role. The Pro add-on adds SMS codes, the managed relay for codes, the challenge inside a WooCommerce storefront and adaptive policies. The sign-in sensors themselves are on Sensors and blocking.

The methods

Secrets are encrypted at rest with libsodium, with OpenSSL as fallback. On the profile page every user sees their methods as cards, adds or removes one, and picks the method the sign-in offers first.

Enforcement per role

Under Core protection → Two-Factor Authentication you choose the methods the site offers and the roles that must use one; administrators are preset. An enforced user gets an enrolment wizard at the next sign-in and a grace period of 7 days. When grace period and skips are used up, the user is signed in and led straight into the setup without a skip button. The stricter policy Block sign-in exists, but administrators and super admins always take the setup path, so a site never loses its last administrator.

Users who are not enforced see a reminder banner. Administrators, editors and shop managers who ignore it for five sign-ins have to finish the setup before they can go on. The password reset asks for the second factor as well, and e-mail codes are not accepted there, so a stolen mailbox alone cannot take over an account.

Passkeys and YubiKeys

The YubiKey 5 series (USB-A, USB-C, Lightning and NFC), the Security Key by Yubico and every other CTAP2 authenticator work on the wp-login challenge, the password reset and the storefront challenge. Older keys that only speak U2F are not supported.

• Setting it up: on Users → Profile → Two-Factor Authentication choose Add security key, name it, insert the key and touch it when the browser asks. On a phone hold an NFC key to the back. No FIDO2 PIN is needed.
• One key per account is free. Business adds several keys per account, so a second YubiKey can wait in a safe place, together with model detection ("YubiKey 5 Series with NFC") and a mail whenever a key is added or removed.
• Lost key: sign in with a recovery code, or the backup key on Business, and remove the lost key on the profile page.
• Cloned keys: each sign-in advances the key's signature counter. A sign-in whose counter does not advance is refused, logged and reported to the account owner by mail, on every plan.
• Algorithms: ES256 on every key, RS256, and Ed25519 on YubiKey firmware 5.2.3 and newer when the server has libsodium. WebAuthn needs HTTPS.

Guessing protection

Wrong codes slow the next attempt down: after 3 for 30 seconds, after 5 for 5 minutes, after 10 for 30 minutes, after 15 for one hour. Beyond that the address is blocked like any other sensor hit (event 2fa_brute_force), with escalation and, in the Community Network, a report.

Storefront 2FA for WooCommerce

Part of the Pro add-on from the Professional plan. Customers who sign in through My Account, the classic checkout or the WooCommerce Cart and Checkout blocks confirm the second factor on a page in your theme instead of wp-login.php. Cart and checkout survive the detour, and the trusted device cookie is shared with the wp-admin sign-in.

• Addresses: challenge reportedip-hive-2fa and setup reportedip-hive-2fa-setup by default, both changeable and checked for conflicts. On a network each site can set its own address.
• Other 2FA plugins: when Solid Security, the Two-Factor plugin or Wordfence 2FA owns the sign-in form, Hive says so and keeps its storefront challenge off, so nobody is asked twice.
• Plan change: on a lower plan the storefront challenge pauses; settings and enrolments stay and come back with the plan.

Adaptive step-up

Part of the Pro add-on from the Professional plan. Enforcement asks at every sign-in; adaptive step-up asks a user who has a method again only when something about the sign-in changed. The matrix under Advanced → Adaptive Step-Up has one row per role and one column per trigger.

• New country, new IP address, new network (/24 or IPv6 /64) or new device, each against the user's own history. The country needs the Community Network.
• Every N days since the last challenge and every N sign-ins.
• More than N concurrent sessions of that user.

A triggered challenge ignores the trusted device cookie: the device is trusted, the circumstances are not. The 2FA IP allowlist and the filter reportedip_2fa_bypass still apply. A user without a method is never locked out; the skip is logged and the user is reminded. The first sign-in after a trigger goes on never asks, and the administrator row can only be armed after an administrator passed one challenge on the site.

How codes are delivered

Mails go through wp_mail() by default, so your SMTP plugin applies. With the Pro add-on on the Professional plan and up, 2FA codes, security alerts and the other plugin mails go through the managed reportedip.com relay with SPF, DKIM and DMARC in place, and SMS codes through the SMS relay. When the monthly allowance and any top-up are used up, mail falls back to wp_mail(); the other methods keep working. Allowances and bundles are on Pro add-on and plans.

Last updated: 16. October 2026 · Maintained by the ReportedIP team